Privacy Policy
This policy explains how we process personal data in the app and web app Flaï Surf (wind forecast, spot catalogue and session tracking for kitesurfing, windsurfing and wingfoiling) — in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR).
1. Controller
The controller for data processing within the meaning of the GDPR is:
Oliver Hirzel
Schweinheimer Straße 54D
51067 Cologne, Germany
Email: flaisurf@gmail.com
For data protection requests (access, erasure, etc.) a message to the email address above is sufficient. No data protection officer has been appointed, as the conditions of Art. 37 GDPR / § 38 BDSG (German Federal Data Protection Act) are not met.
2. Data processed, purposes and legal bases
We process personal data solely in order to provide you with the features of Flaï. In detail:
| Data category | Purpose | Legal basis (Art. 6 / 9 GDPR) |
|---|---|---|
| Account / login data – email address, password hash (or Google sign-in), email verification status | Creating and securing your account, login | Performance of a contract (Art. 6(1)(b)) |
| Profile data – display name/nickname, optional profile picture, home town, main sport, nationality, weight/skill level (for gear size suggestions) | Personalisation, display in the Tribe/community area | Performance of a contract or consent (Art. 6(1)(b) and (a)) |
| Spot data – spots you create, including location coordinates, names and your wind/weather criteria | Calculating the wind rating and forecast windows per spot | Performance of a contract (Art. 6(1)(b)) |
| Session / tracking data – GPS track data, speed, distance, duration, jump data, and — when using a paired smartwatch — heart rate | Recording and analysing your sessions (logbook, statistics) | Consent (Art. 6(1)(a)); for heart rate as health data additionally explicit consent under Art. 9(2)(a) |
| Live location – your current position during an ongoing live session, if you enable live tracking | Showing your live position to the audience you select (e.g. followers or emergency contacts) | Consent (Art. 6(1)(a)) |
| Emergency / SOS data – your emergency contacts, triggered alerts including your location at the time of the alert | Buddy/emergency alerting on the water | Consent (Art. 6(1)(a)); where applicable vital interests (Art. 6(1)(d) / Art. 9(2)(c)) |
| Social / Tribe data – follower relationships, chat messages, buddy plans, a hash of your email address (SHA-256, to be found by full address) | Community features (following, chat, joint session planning) | Performance of a contract or consent (Art. 6(1)(b) and (a)) |
| Push token – device-specific token (Firebase Cloud Messaging) | Sending wind, chat and emergency notifications | Consent (Art. 6(1)(a)) |
| Technical data / error telemetry – error reports from the app, server log data (IP address, timestamp, user agent) | Operation, security and troubleshooting of the service | Legitimate interests (Art. 6(1)(f)) |
| Feedback – feedback you submit voluntarily | Improving the app | Legitimate interests / consent (Art. 6(1)(f) or (a)) |
Where processing is based on your consent, you may withdraw it at any time with effect for the future (e.g. by disabling the relevant feature or deleting your account). The lawfulness of processing carried out before withdrawal remains unaffected.
3. Visibility to other users
Depending on your settings, certain information is visible to other users: your profile (name, picture, home town, sport) in the Tribe area, published sessions (in reduced form, with a rounded position for your own spots), chat messages to the people you write to, and — with live tracking or SOS active — your location to the audience you select. You control visibility through the settings (e.g. “Everyone / Followers / Emergency contacts”) and can stop sharing at any time.
4. Hosting and services used (processors / recipients)
We use the following service providers to deliver the service. Where required, data processing agreements pursuant to Art. 28 GDPR are in place with them.
- Google Firebase / Google Cloud (Google Ireland Ltd. / Google LLC) – authentication, database (Firestore, EU region), cloud functions, cloud messaging (push), hosting and file storage. Some server functions run in the USA (region us-central1; see section 5).
- Google Maps Platform (Google Ireland Ltd.) – map display, place and nearby search, and location details when creating and viewing spots.
- Open-Meteo (Open-Meteo, Switzerland) – retrieval of weather and forecast data based on spot coordinates. No data identifying you is transmitted, only coordinates.
- Esri World Imagery – satellite map tiles for the 3D globe and map views.
- AI services for spot analysis – Anthropic (Claude) and Google (Gemini), for automatic analysis of spot characteristics (wind directions, description). Only spot-related information (coordinates, map section) is transmitted, no account data.
5. Transfers to third countries (USA)
With some of the services mentioned (in particular Google Cloud Functions in the us-central1 region and the AI services used), processing may take place in the USA. Such transfers are based on the EU-US Data Privacy Framework (where the provider is certified) and/or on the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR as appropriate safeguards. Despite these safeguards, a transfer to the USA generally entails the risk of access by US authorities.
6. Cookies and local storage
Flaï uses no cookies or storage technologies for advertising or analytics purposes. We only store technically necessary information on your device (e.g. your login status via Firebase Authentication, and functional settings such as your chosen language and colour scheme in your browser’s local storage). This storage is strictly necessary to operate the app you explicitly requested and therefore does not require consent under § 25(2) no. 2 TDDDG (German Digital Services Data Protection Act).
Analytics and advertising (currently inactive)
This section only applies once such services are activated — until then no analytics or advertising processing takes place. Should we use analytics or advertising services in the future (e.g. Google Analytics or Google Ads), this will be done solely on the basis of your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR, obtained via a consent banner (consent management). You may withdraw consent at any time with effect for the future. Details of the individual services (provider, data processed, retention period, third-country transfers) will be added here upon activation.
7. Push notifications
Push notifications are optional and require your explicit permission on the device. You can disable them at any time in your device or app settings. Invalid or expired push tokens are removed automatically.
8. Retention period
Your data is stored for as long as your account exists or as long as it is necessary for the purposes stated. You can delete individual items (spots, sessions, tokens) in the app at any time. Unverified accounts are removed automatically after a short period. Live location data is kept only for the duration of the live session and deleted afterwards. If you delete your account, your personal data is deleted unless statutory retention obligations apply.
9. Deleting your account
You can delete your account and all associated data yourself in the app (menu → Delete account). Alternatively, a message to the email address above is sufficient. See also our account deletion page.
10. Your rights
Under the GDPR you have the right to:
- access the data stored about you (Art. 15),
- rectification of inaccurate data (Art. 16),
- erasure (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interests (Art. 21),
- withdraw consent given, with effect for the future (Art. 7(3)).
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
11. Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The competent authority for the controller is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de
12. Minors
Flaï is intended for adults. A user account requires you to be of legal age, which means at least 18 years old (§ 3 of the terms of service). We do not knowingly collect personal data from anyone under 18.
The age limit follows from what the app does: it processes heart rate, which is health data under Art. 9 GDPR; it can make your precise location visible to other users; and it includes a chat between users. We require legal age so that consent to this processing is valid.
If you are a parent or guardian and have reason to believe that a child has provided us with data, write to flaisurf@gmail.com and we will delete the account and the associated data without delay.
13. Changes to this privacy policy
We update this privacy policy when the features of the app or the legal situation change. The current version is always available at this address.
Last updated: August 2026 · Binding version: German